Notices by nadja (dequbed@mastodon.chaosfield.at)

@quixoticgeek The given incident was identified as a likely outcome at an early stage of the design process but considered by <you> to be of negligible risk.

@cwebber maybe this will finally show people why DNSSEC isn't exactly a workable replacement for the mess that is the current PKI either ^^'

@skinnylatte @PhoenixSerenity if somebody needs to rob people (and isn't fash) they have probably fallen on hard times & I'd feed them as well ^^
Good to know there are more people like that :D

@soatok > His puns are 100% whole groan.
I see they let you write your own speaker introduction :P

@soatok The singular other advantage EdDSA has over ML-DSA is signature size. Even more so if you have to send over the public key as well. But the problems where you have that extreme size constraints *and* require signatures over e.g. MACs are pretty rare to begin with, so it's definitely a the nichest of advantages. So yeah, ML-DSA all the way ^^

@soatok > cheapen labor and extract more value for themselves

Which is still why I argue we need liability for software bugs that is persecuted ex officio; it can't be that in 2026 companies are still hiding behind the “software just does that *shrug*” excuse for bugs and security issues.

@pascoda @GreenSkyOverMe @wurzelmann @jollysea "Rumänien, Ungarn und andere Deutschsprachigen Regionen"? RUANDR!

@wurzelmann @pascoda @jollysea BACHL…D?

@soatok rubbing me the wrong way *more so than usual* that is, but the usual amount is below the noise floor of bad cryptography-related takes that float around everywhere.

@soatok They've been rubbing me the wrong way the last month as well, and I'm deliberating the same decision. So fwiw, you're not alone there :p

So, with stuff actually working now I think I can finally talk about what's been my hyperfocus for the last three days. To not put too fine a point to it, the tool ecosystem for cryptographic signatures is atrocious. Granted, the use-cases for those are also beyond niche, but when you need them you *really* need them.
And especially the gpg.fail talk at 39C3 has reminded me just how bad the situation is, but it has also reminded me that I am in fact a cryptographer, and I can just *improve it*.

The result of those three days researching and hacking away?
I've started work on a signing tool that allows its users to stop thinking about signing. It doesn't try to be a swiss army knife, and it has no knobs to fiddle with. It signs stuff, and it verifies stuff, but it does so with very secure defaults and according to open standards instead of being the tenth home-grown tool that does everything *slightly* different enough to the rest to be frustratingly incompatible.

If you're interested in such a tool or would like to get some experience writing cryptographic software where all the arduous work of designing the math and formats to be secure has been done by loads of smart people (and one stupid fox) already, go here: https://codeberg.org/dequbed/nbysign

@soatok I wish I was surprised but no this entirely tracks. PGP in general and GnuPG specifically are the masters of “that's not a bug, you're just holding it wrong”.

To which I will just quote Maxim 62 of Schlock Mercenary:
“Anything labeled "This end toward enemy" is dangerous at both ends.”
To wit, if you can hold it wrong it's dangerous even if held right. Cryptography is too important to only be available in dangerous tools.

@skinnylatte @keira_reckons especially if you don't want it :blobcatnotlikethis:

@skinnylatte @keira_reckons obviously the only reason women would flirt with each other is to fuck each other and the only reason women would fuck each other is so they can get a man because we all know women don't *actually* want sex

@whitequark *sigh* and it would not even been hard to do properly. Adding a (readable) write counter and including that in a proper checksum is not *that* much more complicated <.<

@izzy Use the service brake then? :p

@izzy Well, I don't either but I only ever learned hill starts using the service brake ^^'

@izzy uh, hold car with service brake, ease off clutch until the slipping point so it holds the car in place instead of the brake, let go of brake and throttle up while adjusting the clutch so you're not stalling the motor. If you're driving heavy loads / old cars / in very hilly terrain, adjust neutral throttle up so there's less slip back between releasing brake and throttling up